Set up SSO with Google Workspace

Pilot

Company single sign-on is currently enabled only for pilot organizations. It is not generally available yet. You create the connection in Focus in Settings → Security → Single sign-on, which is part of the new version of the dashboard and is shown to the owner of the organization.

This guide creates an OAuth client for Workify360 Focus in your Google Workspace organization. You need a Google Workspace administrator account and a verified domain in Focus (domain verification). Read single sign-on first for how testing, activation and sign-in work.

Everyone can already use sign in with Google with their own Google account. A Google Workspace connection adds what a company needs: only accounts of your Workspace domains are accepted, people can be added on their first sign-in, and the desktop app checks the account regularly.

What to register in Google Cloud

Setting	Value
OAuth consent screen, user type (audience)	Internal, so only accounts of your Workspace organization can use it
Scopes	openid, email, profile
OAuth client type	Web application
Authorized redirect URI	https://auth.focus.workify360.com/sso/oidc/callback

Step by step

1. Sign in to the Google Cloud console with your Workspace administrator account and select or create a Google Cloud project for the app.

2. Set up the OAuth consent screen: choose the user type Internal, name the app (for example “Workify360 Focus”) and add the scopes openid, email and profile.

3. Open Credentials → Create credentials → OAuth client ID and choose the application type Web application.

4. Under Authorized redirect URIs, add:

   https://auth.focus.workify360.com/sso/oidc/callback

5. Choose Create and copy the Client ID and the Client secret.

Create the connection in Focus

1. Open Settings → Security → Single sign-on and choose Add connection.
2. Choose the provider Google Workspace. The issuer is always https://accounts.google.com, so there is no issuer field.
3. Enter the name shown on the sign-in page, the client ID and the client secret.
4. Check the Redirect URI step against what you registered in Google Cloud, choose who is added on their first sign-in, and save.
5. Choose Test connection, sign in with an account of your verified domain in the new tab and check the results on the card; the Workspace domain check must pass.
6. Choose Activate (a passed test from the last 24 hours is needed, sso_test_required).

The Workspace domain rule (hd)

Google tells Focus which Workspace organization an account belongs to, in the hd value. Focus accepts a sign-in only when:

• Google marks the e-mail address as verified,
• hd is one of your verified domains, and
• the e-mail address is on that same domain.

Personal Gmail accounts, which have no hd, and accounts of other Workspace organizations are refused, even if someone types your domain on the sign-in page. Focus also passes your first verified domain to Google as a hint, so Google suggests the right account, but the check above is what decides. Addresses on a secondary domain of your Workspace are not accepted by this connection yet.

Desktop app and multi-factor authentication

• When someone signs in to the desktop app, Focus asks Google for offline access, so Google may show a consent screen the first time. The desktop app needs it to check the account regularly (how long access can last).
• Google does not tell Focus whether multi-factor authentication was used, so requiring it from the identity provider (requireIdpMfa) does not work for Google Workspace: leave “Require two-step verification at the provider” off. Enforce 2-Step Verification in the Google Admin console instead.